CWE-209
AllowedGeneration of Error Message Containing Sensitive Information
Abstraction: Base · Status: Draft
The product generates an error message that includes sensitive information about its environment, users, or associated data.
833 vulnerabilities reference this CWE, most recent first.
GHSA-CFQH-HP29-CJQ6
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.
{
"affected": [],
"aliases": [
"CVE-2025-40760"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T21:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.",
"id": "GHSA-cfqh-hp29-cjq6",
"modified": "2025-11-11T21:30:28Z",
"published": "2025-11-11T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40760"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-514895.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CFQM-RCFX-9R9W
Vulnerability from github – Published: 2023-02-11 03:32 – Updated: 2023-02-21 21:30Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.
{
"affected": [],
"aliases": [
"CVE-2022-46675"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-11T01:23:00Z",
"severity": "MODERATE"
},
"details": "Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.",
"id": "GHSA-cfqm-rcfx-9r9w",
"modified": "2023-02-21T21:30:19Z",
"published": "2023-02-11T03:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46675"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJR9-MR35-7XH6
Vulnerability from github – Published: 2023-04-13 17:53 – Updated: 2023-04-14 21:35Background
The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.
The /debug/pprof/cmdline endpoint served by the metrics service (defaulting running on port 9090) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary.
Impact
All deployments abiding by the recommended best practices for production usage are NOT affected: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator
Users configuring SpiceDB via environment variables are NOT affected.
Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key via command-line flag.
Workarounds
To workaround this issue you can do one of the following:
- Configure the preshared key via an environment variable (e.g.
SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve) - Reconfigure the
--metrics-addrflag to bind to a trusted network (e.g.--metrics-addr=localhost:9090) - Disable the metrics service via the flag (e.g.
--metrics-enabled=false) - Adopt one of the recommended deployment models: Authzed's managed services or the SpiceDB Operator
References
- GitHub Security Advisory issued for SpiceDB
- Go issue #22085 for documenting the risks of exposing pprof to the internet
- Go issue #42834 discusses preventing pprof registration to the default serve mux
- semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure checks for a variation of this issue
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/authzed/spicedb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-29193"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-13T17:53:38Z",
"nvd_published_at": "2023-04-14T20:15:00Z",
"severity": "HIGH"
},
"details": "### Background\n\nThe `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.\n\nThe `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary.\n\n### Impact\n\nAll deployments abiding by the recommended best practices for production usage are **NOT affected**:\n- Authzed\u0027s SpiceDB Serverless\n- Authzed\u0027s SpiceDB Dedicated\n- SpiceDB Operator\n\nUsers configuring SpiceDB via environment variables are **NOT affected**.\n\nUsers **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag.\n\n### Workarounds\n\nTo workaround this issue you can do one of the following:\n\n- Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`)\n- Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`)\n- Disable the metrics service via the flag (e.g. `--metrics-enabled=false`)\n- Adopt one of the recommended deployment models: [Authzed\u0027s managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator)\n\n### References\n\n- [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6)\n- [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet\n- [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux\n- [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue",
"id": "GHSA-cjr9-mr35-7xh6",
"modified": "2023-04-14T21:35:43Z",
"published": "2023-04-13T17:53:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29193"
},
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/commit/9bbd7d76b6eaba33fe0236014f9b175d21232999"
},
{
"type": "PACKAGE",
"url": "https://github.com/authzed/spicedb"
},
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/releases/tag/v1.19.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "SpiceDB binding metrics port to untrusted networks and can leak command-line flags"
}
GHSA-CM22-PWH9-X3R2
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219
{
"affected": [],
"aliases": [
"CVE-2021-20417"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219",
"id": "GHSA-cm22-pwh9-x3r2",
"modified": "2022-05-24T19:06:59Z",
"published": "2022-05-24T19:06:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20417"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196219"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6469691"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CPH6-524F-3HGR
Vulnerability from github – Published: 2025-11-13 23:07 – Updated: 2025-11-15 03:15Summary:
An observable difference in error messaging was found in the Directus REST API. The /items/{collection} API returns different error messages for these two cases:
1. A user tries to access an existing collection which they are not authorized to access.
2. A user tries to access a non-existing collection.
The two differing error messages leak the existence of collections to users which are not authorized to access these collections.
Details:
The following response returns an error message, when requesting a collection the user is not authorized to access.
GET /items/no-access
{
"errors": [
{
"message": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"extensions": {
"reason": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"code": "FORBIDDEN"
}
}
]
}
The following response returns a different error message when requesting a collection which does not exist.
GET /items/does-not-exist
{
"errors": [
{
"message": "You don't have permission to access this.",
"extensions": {
"code": "FORBIDDEN"
}
}
]
}
Impact:
The difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.
Credit:
Sebastian Krause - Hackmanit GmbH
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.13.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "32.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64749"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-13T23:07:31Z",
"nvd_published_at": "2025-11-13T22:15:52Z",
"severity": "MODERATE"
},
"details": "### Summary:\n\nAn observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases:\n1. A user tries to access an existing collection which they are not authorized to access.\n2. A user tries to access a non-existing collection.\n\nThe two differing error messages leak the existence of collections to users which are not authorized to access these collections.\n\n### Details:\n\nThe following response returns an error message, when requesting a collection the user is not authorized to access.\n\n```\nGET /items/no-access\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"extensions\": {\n \"reason\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\nThe following response returns a different error message when requesting a collection which does not exist.\n\n```\nGET /items/does-not-exist\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access this.\",\n \"extensions\": {\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\n### Impact:\n\nThe difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.\n\n### Credit:\n\nSebastian Krause - [Hackmanit GmbH](https://hackmanit.de)",
"id": "GHSA-cph6-524f-3hgr",
"modified": "2025-11-15T03:15:40Z",
"published": "2025-11-13T23:07:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64749"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directus Vulnerable to Information Leakage in Existing Collections"
}
GHSA-CPVX-2365-466C
Vulnerability from github – Published: 2023-09-06 15:30 – Updated: 2023-09-08 12:18By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-superset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-39264"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-08T12:18:38Z",
"nvd_published_at": "2023-09-06T13:15:08Z",
"severity": "MODERATE"
},
"details": "By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users.\u00a0This vulnerability exists in Apache Superset versions up to and including 2.1.0.",
"id": "GHSA-cpvx-2365-466c",
"modified": "2023-09-08T12:18:38Z",
"published": "2023-09-06T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39264"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/superset"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Superset may expose internal traces on REST API endpoints"
}
GHSA-CPXH-JWHH-M496
Vulnerability from github – Published: 2024-10-31 21:31 – Updated: 2024-11-01 18:31An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.
{
"affected": [],
"aliases": [
"CVE-2024-39719"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-31T20:15:04Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the \"File does not exist\" error message to the attacker, providing a primitive for file existence on the server.",
"id": "GHSA-cpxh-jwhh-m496",
"modified": "2024-11-01T18:31:32Z",
"published": "2024-10-31T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39719"
},
{
"type": "WEB",
"url": "https://oligosecurity.webflow.io/blog/more-models-more-probllms"
},
{
"type": "WEB",
"url": "https://www.oligo.security/blog/more-models-more-probllms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQ5F-WV7P-5GFC
Vulnerability from github – Published: 2024-11-18 12:30 – Updated: 2024-11-18 23:46A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-48896"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:46:20Z",
"nvd_published_at": "2024-11-18T12:15:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Moodle. It is possible for users with the \"send message\" capability to view other users\u0027 names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.",
"id": "GHSA-cq5f-wv7p-5gfc",
"modified": "2024-11-18T23:46:21Z",
"published": "2024-11-18T12:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48896"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318822"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle leaks user names"
}
GHSA-CQM8-RG2P-JFCF
Vulnerability from github – Published: 2025-06-27 00:31 – Updated: 2026-01-08 20:12A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-cli-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.0.0.Dev01"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-5731"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-27T22:04:43Z",
"nvd_published_at": "2025-06-26T22:15:24Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.",
"id": "GHSA-cqm8-rg2p-jfcf",
"modified": "2026-01-08T20:12:10Z",
"published": "2025-06-27T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5731"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10130"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-5731"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370429"
},
{
"type": "PACKAGE",
"url": "https://github.com/infinispan/infinispan"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information"
}
GHSA-CRCJ-W6H9-Q5F6
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2025-04-11 03:39Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-3332"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-09-22T19:00:00Z",
"severity": "MODERATE"
},
"details": "Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\"",
"id": "GHSA-crcj-w6h9-q5f6",
"modified": "2025-04-11T03:39:12Z",
"published": "2022-05-13T01:13:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3332"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61898"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365"
},
{
"type": "WEB",
"url": "http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx"
},
{
"type": "WEB",
"url": "http://isc.sans.edu/diary.html?storyid=9568"
},
{
"type": "WEB",
"url": "http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/41409"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1024459"
},
{
"type": "WEB",
"url": "http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310"
},
{
"type": "WEB",
"url": "http://twitter.com/thaidn/statuses/24832350146"
},
{
"type": "WEB",
"url": "http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx"
},
{
"type": "WEB",
"url": "http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx"
},
{
"type": "WEB",
"url": "http://www.ekoparty.org/juliano-rizzo-2010.php"
},
{
"type": "WEB",
"url": "http://www.microsoft.com/technet/security/advisory/2416728.mspx"
},
{
"type": "WEB",
"url": "http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/43316"
},
{
"type": "WEB",
"url": "http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security"
},
{
"type": "WEB",
"url": "http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2429"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2751"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Mitigation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Mitigation MIT-33
Strategy: Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Mitigation MIT-40
Strategy: Compilation or Build Hardening
Debugging information should not make its way into a production release.
Mitigation MIT-40
Strategy: Environment Hardening
Debugging information should not make its way into a production release.
Mitigation
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Mitigation
Create default error pages or messages that do not leak any information.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-54: Query System for Information
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
CAPEC-7: Blind SQL Injection
Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the adversary determines how and where the target is vulnerable to SQL Injection.